Ecommerce Hosting Embedding their GTM Code - Does this give them access to our analytics?

It's very conceivable that EKMPowershop can view the GA data wherever their property ID resides on your site. In fact, if somehow my own property ID is placed on your site, then the traffic on the pages where my property ID is on will send data to my reports. If your code is also on all pages, then you would also be sending data to your own account, too. But one can only see the data they are collecting, wherever their code is on your site.